Data processing agreement

1. Who this agreement is between

This agreement is between the nursery that uses Nuru (the data controller) and Databit Limited, a technology company registered in Kenya (the data processor). It forms part of the terms of service and follows section 42 of Kenya's Data Protection Act, 2019.

2. What we process

Purpose: to provide Nuru to the nursery: keeping children's records, attendance, daily diaries, messages and posts, and showing them to the people the nursery chooses.

Whose data: children at the nursery, their parents, guardians and emergency contacts, and the nursery's owner and educators.

What data: names, contact details, dates of birth, gender, room, attendance times, daily diary entries, photos, messages, and health information such as allergies and medication given.

How long: for as long as the nursery uses Nuru, then as set out in section 10.

3. Acting on the nursery's instructions

We process records only to provide Nuru and on the nursery's documented instructions, which include these terms and the settings the nursery chooses in Nuru. If we think an instruction breaks the law, we'll say so. If the law ever requires us to process records in another way, we'll tell the nursery first unless the law forbids it.

4. Confidentiality

Everyone at Databit Limited who can reach nursery records is bound by confidentiality, and only looks at records when it is needed to provide or support Nuru.

5. Security

We use the technical and organisational measures described on the data security page, and we keep them under review. We won't make them weaker during the agreement.

6. Service providers (sub-processors)

The nursery agrees that we may use these providers. Each one is bound by a written agreement that protects records at least as well as this one.

We'll email nurseries at least 30 days before adding or replacing a provider that handles records. If the nursery objects for a good data protection reason and we can't solve it, the nursery can cancel and get a refund of time paid for and not used.

7. Transfers outside Kenya

Records are stored in the European Union (Ireland), under European Union data protection law and our agreement with the provider. We'll give the nursery the information it needs to show these safeguards to the Data Protection Commissioner. Because health information is sensitive, the nursery agrees to get parents' consent to it being stored outside Kenya, which our parent consent form covers.

8. Helping the nursery

• If a parent or anyone else asks us directly about their data, we pass the request to the nursery and help it respond.
• We help the nursery with data protection impact assessments and with questions from the Data Protection Commissioner, as far as they concern Nuru.
• We give the nursery the information it reasonably needs to check we are keeping to this agreement.

9. Breaches

If we become aware of a breach affecting the nursery's records, we tell the nursery without delay, and within 48 hours where we can. We tell it what happened, what records are affected and what we are doing about it, and we help it notify the Data Protection Commissioner within 72 hours and tell the people affected where required.

10. When the agreement ends

When the nursery closes its account, it has 30 days to ask for a copy of its records. We then delete them from Nuru within 90 days, including from backups as they expire, unless the law requires us to keep something. We'll confirm in writing when deletion is complete.

11. Contact

Questions about this agreement, or to ask for a signed copy: hello@nurucare.app.